Installazione di Custom Edition in un ambiente air-gapped

Un ambiente air-gapped è una rete fisicamente isolata dalle reti esterne per motivi di sicurezza. È possibile installare Custom Edition in un ambiente air-gapped.

Prerequisiti

Assicurarsi che siano soddisfatti i seguenti prerequisiti.

  • Instana Si ottengono la chiave di vendita e la chiave di download.
  • Instana e vengono scaricate le immagini dei contenitori di archiviazione dati.

Sicurezza

  • Supporti sicuri approvati (unità USB o simili) per il trasferimento di artefatti
  • Conformità alle politiche di sicurezza air-gap della tua organizzazione

Strumenti

  • kubectl è installato e configurato per il tuo cluster.
  • Helm è installato (o pronto per essere installato offline).
  • Docker oppure Podman per gestire le immagini.
  • (Opzionale): Skopeo per copiare immagini tra registri.

Autorizzazioni e credenziali

  • Accesso a una macchina online per scaricare artefatti
  • Autorizzazione dell'amministratore del cluster per distribuire l'edizione personalizzata.
  • Credenziali per:
    • Instana repository degli artefatti ($DOWNLOAD_KEY)
    • Registro contenitori interno (nome utente e password)

Procedura

Per installare Self-Hosted Custom Edition ( Kubernetes o Red Hat OpenShift Container Platform ) in un ambiente air-gapped, completare i seguenti passaggi:
Nota:
È necessario creare i segreti prima di iniziare l'installazione. In caso contrario, i segreti vengono generati automaticamente. È possibile configurare i segreti preesistenti per tutti i grafici " Helm " relativi agli archivi dati.
Nota:
Il server host di Jump deve essere connesso a Internet e avere accesso al cluster o all'ambiente isolato (air-gapped) in cui viene installato il backend di Instana.
Nota:
Le immagini incluse negli esempi sono destinate a Linux x86_64.

  1. Configurazione dell'ambiente.

    1. Preparare i cluster, lo storage e la rete dell' Kubernetes.
    2. Verifica dei prerequisiti: versioni Kubernetes e Helm

  2. Installare il plug-in Instana kubectl, vedere Installazione del plug-in Instana kubectl.

  3. Installare Helm :

    curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
chmod 700 get_helm.sh
./get_helm.sh

  4. Verificare le versioni di Instana e Operator:

    kubectl instana -v

  5. Recupera l'elenco delle immagini sul backend di Instana :

    kubectl instana versions list-images -d $DOWNLOAD_KEY

    È possibile visualizzare un output simile al seguente:

    artifact-public.instana.io/backend/acceptor:3.xxx.xxx-0
...
...
artifact-public.instana.io/backend/gateway:1.26.3_v0.46.0
artifact-public.instana.io/backend/config-templates:3.xxx.xxx-0
artifact-public.instana.io/infrastructure/instana-enterprise-operator:1.3.0
artifact-public.instana.io/infrastructure/instana-enterprise-operator-webhook:1.3.0

  6. Carica artefatti:

    1. Chiave di download per l'esportazione:

      export DOWNLOAD_KEY="<download_key>"

    2. Accedi al registro dell' Instana :

      Nota:
      Eseguire uno dei seguenti comandi a seconda che si utilizzi Skopeo o Docker.

      • Skopeo:

        skopeo login -u _ -p $DOWNLOAD_KEY artifact-public.instana.io

      • Docker:

        docker login -u _ -p $DOWNLOAD_KEY artifact-public.instana.io

    3. Accedi al registro immagini interno

      • Skopeo:

        skopeo login -u <your_internal_artifactory_username> -p <your_internal_artifactory_password> <internal-image-registry>

      • Docker:

        docker login -u <your_internal_artifactory_username> -p <your_internal_artifactory_password> <internal-image-registry>

        Non modificare il nome effettivo delle immagini. Modifica solo l' URL e e il percorso di Artifactory. Ad esempio, se si esegue kubectl instana versions list-images e il nome dell'immagine restituito è artifact-public.instana.io/backend/acceptor:3.xxx.xxx–x, è necessario inviare l'immagine al proprio Artifactory interno nel seguente formato: <internal-image-registry>/<internal-image-repository-path>/acceptor:<tag_of_image>.

  7. Installa edizione personalizzata :

    1. Crea spazi dei nomi per Instana :

      for ns in cert-manager instana-kafka instana-clickhouse instana-postgres instana-cassandra instana-elastic instana-core instana-units instana-operator; do kubectl create namespace $ns; done

    2. Crea segreti di pull delle immagini negli spazi dei nomi dell' Instana.

       for ns in cert-manager instana-kafka instana-clickhouse instana-postgres instana-cassandra instana-elastic instana-core instana-units instana-operator; do kubectl create secret docker-registry instana-registry --docker-server=<internal-image-registry> --docker-username=<your_internal_artifactory_username> --docker-password=<your_internal_artifactory_password> -n $ns; done

      Per il registro immagini interno di OpenShift Container Platform, questo passaggio può essere omesso.

    3. Scaricare gli artefatti e caricarli in un registro immagini interno

      Nota:
      Copia le immagini dal tuo host bastion nel tuo registro immagini interno. Eseguire una delle seguenti operazioni a seconda che si utilizzi Skopeo o Docker. Non modificare il nome effettivo delle immagini. Modifica solo l' URL e e il percorso di Artifactory. Ad esempio, se si esegue e kubectl instana versions list-images il nome dell'immagine restituito è artifact-public.instana.io/backend/acceptor:3.xxx.xxx–x, allora è necessario caricare l'immagine sul proprio Artifactory interno nel seguente formato: <registro-immagini-interno>/<percorso-repository-immagini-interno>/acceptor:<tag_dell'immagine>.

      • Skopeo:

        1. Copia le immagini Strimzi:

          skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/operator/strimzi:1.0.1_v0.33.0 docker://<internal-image-registry>/<internal-image-repository-path>/strimzi:1.0.1_v0.33.0
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/datastore/kafka:1.0.1-kafka-4.1.2_v0.37.0 docker://<internal-image-registry>/<internal-image-repository-path>/kafka:1.0.1-kafka-4.1.2_v0.37.0

        2. Copia le immagini Elasticsearch :

          skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/operator/elasticsearch:3.4.1_v0.34.0 docker://<internal-image-registry>/<internal-image-repository-path>/elasticsearch-operator:3.4.1_v0.34.0
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/datastore/elasticsearch:8.19.18_v0.37.0 docker://<internal-image-registry>/<internal-image-repository-path>/elasticsearch:8.19.18_v0.37.0

        3. Copia le immagini CNPG Postgres :

          skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/operator/cloudnative-pg:v1.29.2_v0.35.0 docker://<internal-image-registry>/<internal-image-repository-path>/cloudnative-pg-operator:v1.29.2_v0.35.0
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/datastore/cnpg-containers:15_v0.40.0 docker://<internal-image-registry>/<internal-image-repository-path>/cnpg-containers:15_v0.40.0

        4. Copia le immagini dell' Cassandra :

          skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/operator/cass-operator:1.30.3_v0.41.0 docker://<internal-image-registry>/<internal-image-repository-path>/cass-operator:1.30.3_v0.41.0
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/datastore/cassandra:4.1.11_v0.43.0 docker://<internal-image-registry>/<internal-image-repository-path>/cassandra:4.1.11_v0.43.0
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/datastore/system-logger:1.30.3_v0.24.0 docker://<internal-image-registry>/<internal-image-repository-path>/system-logger:1.30.3_v0.24.0
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/datastore/k8ssandra-client:0.8.14_v0.34.0 docker://<internal-image-registry>/<internal-image-repository-path>/k8ssandra-client:0.8.14_v0.34.0

        5. Copia le immagini dell' ClickHouse :

          skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/clickhouse-operator:v1.2.39 docker://<internal-image-registry>/<internal-image-repository-path>/clickhouse-operator:v1.2.39
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/clickhouse:25.8.13.73-7-lts-ibm docker://<internal-image-registry>/<internal-image-repository-path>/clickhouse:25.8.13.73-7-lts-ibm

        6. Copia le immagini cert-manager :

          skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/jetstack/cert-manager-controller:v1.20.3 docker://<internal-image-registry>/<internal-image-repository-path>/cert-manager-controller:v1.20.3
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/jetstack/cert-manager-webhook:v1.20.3 docker://<internal-image-registry>/<internal-image-repository-path>/cert-manager-webhook:v1.20.3
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/jetstack/cert-manager-cainjector:v1.20.3 docker://<internal-image-registry>/<internal-image-repository-path>/cert-manager-cainjector:v1.20.3
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/jetstack/cert-manager-acmesolver:v1.20.3 docker://<internal-image-registry>/<internal-image-repository-path>/cert-manager-acmesolver:v1.20.3
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/jetstack/cert-manager-startupapicheck:v1.20.3 docker://<internal-image-registry>/<internal-image-repository-path>/cert-manager-startupapicheck:v1.20.3
          1. Copia le immagini del backend e dell'operatore dell' Instana :
          while read p; do SOURCE=`echo "$p" | tac -s'/' | head -1`; echo $SOURCE; skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/backend/$SOURCE docker://<internal-image-registry>/<internal-image-repository-path>/$SOURCE; done<images.txt
OPERATOR_IMAGE=`echo "$(cat images.txt | tail -1)" | tac -s'/' |  head -1`
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/infrastructure/$OPERATOR_IMAGE docker://<internal-image-registry>/<internal-image-repository-path>/$OPERATOR_IMAGE

      • Docker

        1. Immagini da trascinare:

          docker pull artifact-public.instana.io/backend/acceptor:3.xxx.xxx–x
docker pull artifact-public.instana.io/clickhouse-operator:v1.2.39

        2. Ritaggia immagini:

          docker tag artifact-public.instana.io/backend/acceptor:3.xxx.xxx–x <internal-image-registry>/<internal-image-repository-path>/acceptor:3.xxx.xxx–x
docker tag artifact-public.instana.io/clickhouse-operator:v1.2.39 <internal-image-registry>/<internal-image-repository-path>/clickhouse-operator:v1.2.39

        3. Immagini push:

          docker push <internal-image-registry>/<internal-image-repository-path>/acceptor:3.xxx.xxx–x
docker push <internal-image-registry>/<internal-image-repository-path>/clickhouse-operator:v1.2.39

  8. Scarica i grafici dell' Helm :

    1. Aggiungi i repository helm.

      helm repo add instana https://artifact-public.instana.io/artifactory/rel-helm-customer-virtual --username=_ --password=$DOWNLOAD_KEY
 
      helm repo update

    2. Scarica i grafici dell' Helm :

      helm pull instana/ibm-clickhouse-operator --version=v1.2.0
helm pull instana/strimzi-kafka-operator --version=1.0.1
helm pull instana/eck-operator --version=3.4.1
helm pull instana/cloudnative-pg --version=0.29.0
helm pull instana/cass-operator --version=0.64.4
helm pull instana/cert-manager --version=v1.20.3

  9. Installare gli archivi dati:

    1. Installare Kafka :

      1. Installare Strimzi nell'operatore Kafka :
        helm install strimzi ./$(ls | grep 'strimzi*' | head -1) --version 1.0.1 -n instana-kafka --create-namespace --set image.imagePullSecrets[0].name="instana-registry" --set image.registry=<internal-image-registry> --set image.name=strimzi --set image.tag=1.0.1_v0.33.0 --set kafka.image.registry=<internal-image-registry> --set kafka.image.name=kafka --set kafka.image.tag=1.0.1-kafka-4.1.2_v0.37.0

      2. Crea un file YAML per il broker. Ad esempio, kafka-broker.yaml con la configurazione del broker.

        apiVersion: kafka.strimzi.io/v1
kind: KafkaNodePool
metadata:
  name: kafka
  labels:
    strimzi.io/cluster: instana
spec:
  replicas: 3
  roles:
    - broker
  storage:
    type: jbod
    volumes:
      - id: 0
        type: persistent-claim
        size: 50Gi
        deleteClaim: true
  template:
    pod:
      tmpDirSizeLimit: 500Mi
      # Add the following Affinity snippet to schedule each pod on a different node.
      # affinity:
      #   podAntiAffinity:
      #     requiredDuringSchedulingIgnoredDuringExecution:
      #       - labelSelector:
      #           matchLabels:
      #             strimzi.io/pool-name: kafka
      #         topologyKey: "kubernetes.io/hostname"

      3. Distribuisci Broker.

        kubectl apply -f kafka-broker.yaml -n instana-kafka

      4. Crea un file YAML per il controller. Ad esempio, kafka-controller.yaml con la configurazione del controller.

        apiVersion: kafka.strimzi.io/v1
kind: KafkaNodePool
metadata:
  name: controller
  labels:
    strimzi.io/cluster: instana
spec:
  replicas: 3
  roles:
    - controller
  storage:
    type: persistent-claim
    size: 50Gi
    deleteClaim: true
  template:
    pod:
      tmpDirSizeLimit: 500Mi
      # Add the following Affinity snippet to schedule each pod on a different node.
      # affinity:
      #   podAntiAffinity:
      #     requiredDuringSchedulingIgnoredDuringExecution:
      #       - labelSelector:
      #           matchLabels:
      #             strimzi.io/pool-name: controller
      #         topologyKey: "kubernetes.io/hostname"

      5. Distribuisci controller.

        kubectl apply -f kafka-controller.yaml -n instana-kafka

      6. Crea un file YAML. Ad esempio, kafka.yaml con la configurazione Kafka.

        apiVersion: kafka.strimzi.io/v1
kind: Kafka
metadata:
  name: instana
  labels:
    strimzi.io/cluster: instana
  annotations:
    strimzi.io/node-pools: enabled
    strimzi.io/kraft:  enabled
spec:
  kafka: 
    Version: 4.1.2
    listeners:
      - name: scram
        port: 9092
        type: internal
        tls: false
        authentication:
          type: scram-sha-512
        configuration:
          useServiceDnsDomain: true
    authorization:
      type: simple
      superUsers:
        - strimzi-kafka-user
    config:
      offsets.topic.replication.factor: 3
      transaction.state.log.replication.factor: 3
      transaction.state.log.min.isr: 2
      default.replication.factor: 3
      min.insync.replicas: 2
      max.message.bytes: 52428800
      message.max.bytes: 52428800
      replica.fetch.max.bytes: 52428800
    template:
      pod:
        tmpDirSizeLimit: 100Mi
  entityOperator:
    template:
      pod:
        tmpDirSizeLimit: 100Mi
        # Add the following securityContext snippet for Kubernetes offerings other than OCP.
        # securityContext:
        #   runAsUser: 1000
        #   fsGroup: 1000
    userOperator:
      image: <internal-image-registry>/<internal-image-repository-path>/strimzi:1.0.1_v0.33.0

      7. Distribuisci Kafka :

        kubectl apply -f kafka.yaml -n instana-kafka
kubectl wait kafka/instana --for=condition=Ready --timeout=300s -n instana-kafka

      8. Creare un utente SASL/SCRAM in Kafka. Crea un file YAML, ad esempio strimzi-kafka-user.yaml:

        apiVersion: kafka.strimzi.io/v1
kind: KafkaUser
metadata:
  name: strimzi-kafka-user
  labels:
    strimzi.io/cluster: instana
spec:
  authentication:
    type: scram-sha-512
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: '*'
          patternType: literal
        operation: All
        host: "*"
      - resource:
          type: group
          name: '*'
          patternType: literal
        operation: All
        host: "*"

      9. Applica l'utente Kafka :

        kubectl apply -f strimzi-kafka-user.yaml -n instana-kafka
kubectl wait kafka/instana --for=condition=Ready --timeout=300s -n instana-kafka

      10. Recupera la password dell'utente Strimzi- Kafka per la configurazione successiva:

        kubectl get secret strimzi-kafka-user  -n instana-kafka --template='{{index .data.password | base64decode}}' && echo
      11. Memorizza la password recuperata nel config.yaml file:
      datastoreConfigs:
...
 kafkaConfig:
   adminUser: strimzi-kafka-user
   adminPassword: <RETRIEVED_FROM_SECRET>
   consumerUser: strimzi-kafka-user
   consumerPassword: <RETRIEVED_FROM_SECRET>
   producerUser: strimzi-kafka-user
   producerPassword: <RETRIEVED_FROM_SECRET>

    2. Installa Elasticsearch.

      1. Installare un operatore Elasticsearch. Se hai creato un segreto di pull dell'immagine, aggiungi --set imagePullSecrets[0].name="<internal-image-registry-pull-secret>" al comando seguente.
        helm install elastic-operator ./$(ls | grep 'eck*' | head -1) -n instana-elastic --create-namespace --version=3.4.1 --set image.repository=<internal-image-registry>/<internal-image-repository-path>/elasticsearch-operator --set image.tag=3.4.1_v0.34.0

      2. Crea un account di servizio ElasticSearch.

        kubectl create serviceaccount elasticsearch -n instana-elastic

      3. Creare un file YAML, ad esempio elastic.yaml, con la configurazione Elasticsearch.

        apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: instana
spec:
  version: 8.19.18
  image: <internal-image-registry>/<internal-image-repository-path>/elasticsearch:8.19.18_v0.37.0
  nodeSets:
    - name: default
      count: 3
      config:
        node.roles:
          - master
          - data
          - ingest
        node.store.allow_mmap: false
      podTemplate:
        spec:
          serviceAccountName: elasticsearch
          imagePullSecrets:
            - name: instana-registry
      volumeClaimTemplates:
        - metadata:
            name: elasticsearch-data
          spec:
            accessModes:
              - ReadWriteOnce
            resources:
              requests:
                storage: 20Gi
  http:
    tls:
      selfSignedCertificate:
        disabled: true

      4. Distribuisci Elasticsearch :

        kubectl apply -f elastic.yaml -n instana-elastic
kubectl wait elasticsearch/instana --for=condition=ReconciliationComplete --timeout=300s -n instana-elastic

        Per impostazione predefinita, viene creato un utente con il nome "elastic" con una password generata in modo casuale.

      5. Recupera la password dell'utente per la configurazione successiva:

        kubectl get secret instana-es-elastic-user -n instana-elastic -o go-template='{{.data.elastic | base64decode}}' && echo
      6. Sostituisci <RETRIEVED_FROM_SECRET> nel config.yaml file con la password recuperata:
      datastoreConfigs:
...
 elasticsearchConfig:
   adminUser: elastic
   adminPassword: <RETRIEVED_FROM_SECRET>
   user: elastic
   password: <RETRIEVED_FROM_SECRET>
...

    3. Installa Postgres.

      1. Per l'edizione personalizzata su un cluster Red Hat OpenShift, determinare l'ID del gruppo del file system su Red Hat OpenShift. Red Hat OpenShift richiede che i gruppi del file system rientrino in un intervallo di valori specifico per lo spazio dei nomi.

        1. Se stai implementando Custom Edition su un cluster Red Hat OpenShift, ottieni l'intervallo di utenti autorizzati.
        kubectl get namespace instana-postgres -o yaml

        Viene visualizzato un output simile al seguente esempio:

        apiVersion: v1
kind: Namespace
metadata:
  annotations:
    .......
    openshift.io/sa.scc.uid-range: 1000750000/10000
  labels:
    kubernetes.io/metadata.name: instana-postgres
                .......
  name: instana-postgres

        L'annotazione openshift.io/sa.scc.supplemental-groups contiene l'intervallo degli ID consentiti. L'intervallo 1000750000/10000 indica 10.000 valori che iniziano con l'ID 1000750000 con un intervallo di ID compreso tra 1000750000 e 1000760000. Nell'esempio, il valore 1000750000 è utilizzato come ID gruppo del file system.

      2. Installare l'operatore Postgres :

        helm install cnpg cloudnative-pg-0.29.0.tgz --set image.repository=<internal-image-registry>/<internal-image-repository-path>/cloudnative-pg-operator --set image.tag=v1.29.2_v0.35.0 --version=0.29.0 -n instana-postgres
 
        # Applicable for Openshift clusters
helm install cnpg cloudnative-pg-0.29.0.tgz --set image.repository=<internal-image-registry>/<internal-image-repository-path>/cloudnative-pg-operator --set image.tag=v1.29.2_v0.35.0 --version=0.29.0 --set containerSecurityContext.runAsUser=<UID from namespace> --set containerSecurityContext.runAsGroup=<UID from namespace> -n instana-postgres

      3. Genera una password per l'archivio dati Postgres.

        1. Genera una password casuale:
          openssl rand -base64 24 | tr -cd 'a-zA-Z0-9' | head -c32; echo
        2. Crea un file, ad esempio postgres-secret.yaml:
          kind: Secret
apiVersion: v1
metadata:
  name: instanaadmin
type: Opaque
stringData:
  username: instanaadmin
  password: <user-generate-password> # Generated password
        3. Applicare il postgres-secrets.yaml file:
        kubectl apply -f postgres-secrets.yaml -n instana-postgres

      4. Creare un file YAML, ad esempio postgres.yaml per la configurazione dell'archivio dati:

        apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: postgres
spec:
  instances: 3
  imageName: <internal-image-registry>/<internal-image-repository-path>/cnpg-containers:15_v0.40.0
  imagePullPolicy: IfNotPresent
  imagePullSecrets:
    - name: instana-registry
  postgresql:
    parameters:
      shared_buffers: 32MB
      pg_stat_statements.track: all
      auto_explain.log_min_duration: '10s'
    pg_hba:
      - local     all          all                            trust
      - host      all          all          0.0.0.0/0         md5
      - local     replication  standby                        trust
      - hostssl   replication  standby      all               md5
      - hostnossl all          all          all               reject
      - hostssl   all          all          all               md5
  managed:
    roles:
    - name: instanaadmin
      login: true
      superuser: true
      createdb: true
      createrole: true
      passwordSecret:
        name: instanaadmin
  bootstrap:
    initdb:
      database: instanaadmin
      owner: instanaadmin
      secret:
        name: instanaadmin
  superuserSecret:
    name: instanaadmin
  storage:
    size: 1Gi

      5. Distribuisci Postgres :

        kubectl apply -f postgres.yaml -n instana-postgres

      6. Salva la password generata nel config.yaml file:

        datastoreConfigs:
...
  postgresConfigs:
    - user: instanaadmin
      password: <USER_GENERATED_PASSWORD>
      adminUser: instanaadmin
      adminPassword: <USER_GENERATED_PASSWORD>
...

    4. Installa Cassandra.

      1. Installare Cert-Manager: Cassandra utilizza Cert Manager per generare certificati.

        helm install cert-manager cert-manager-v1.20.3.tgz --namespace cert-manager --create-namespace --version v1.20.3 --set installCRDs=true --set prometheus.enabled=false --set image.repository=<internal-image-registry>/<internal-image-repository-path>/cert-manager-controller --set webhook.image.repository=<internal-image-registry>/<internal-image-repository-path>/cert-manager-webhook --set cainjector.image.repository=<internal-image-registry>/<internal-image-repository-path>/cert-manager-cainjector --set acmesolver.image.repository=<internal-image-registry>/<internal-image-repository-path>/cert-manager-acmesolver --set startupapicheck.image.repository=<internal-image-registry>/<internal-image-repository-path>/cert-manager-startupapicheck

      2. Se si sta implementando Custom Edition su un cluster Red Hat OpenShift, creare un file, ad esempio cassandra-scc.yaml:

        # Applicable for Openshift clusters
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: cassandra-scc
runAsUser:
  type: MustRunAs
  uid: 999
seLinuxContext:
  type: RunAsAny
fsGroup:
  type: RunAsAny
allowHostDirVolumePlugin: false
allowHostNetwork: true
allowHostPorts: true
allowPrivilegedContainer: false
allowHostIPC: true
allowHostPID: true
readOnlyRootFilesystem: false
users:
  - system:serviceaccount:instana-cassandra:cass-operator
  - system:serviceaccount:instana-cassandra:cassandra

      3. Applicare il file:

        # Applicable for Openshift clusters
kubectl apply -f cassandra-scc.yaml

      4. Installa Cass Operator:

        helm install cass-operator cass-operator-0.64.4.tgz -n instana-cassandra --create-namespace --version=0.64.4 --set securityContext.runAsGroup=999 --set securityContext.runAsUser=999 --set image.registry=<internal-image-registry> --set image.repository=cass-operator --set image.tag=1.30.3_v0.41.0 --set appVersion=1.30.3 --set global.imageConfig.images.system-logger.repository=system-logger --set global.imageConfig.images.system-logger.tag=1.30.3_v0.24.0 --set global.imageConfig.images.k8ssandra-client.repository=k8ssandra-client --set global.imageConfig.images.k8ssandra-client.tag=0.8.14_v0.34.0

      5. Crea un file, ad esempio cassandra.yaml:

        apiVersion: cassandra.datastax.com/v1beta1
kind: CassandraDatacenter
metadata:
  name: cassandra
spec:
  clusterName: instana
  serverType: cassandra
  serverImage: <internal-image-registry>/<internal-image-repository-path>/cassandra:4.1.11_v0.43.0
  k8ssandraClientImage: <internal-image-registry>/<internal-image-repository-path>/k8ssandra-client:0.8.14_v0.34.0
  systemLoggerImage: <internal-image-registry>/<internal-image-repository-path>/system-logger:1.30.3_v0.24.0
  serverVersion: 4.1.11
  podTemplateSpec:
    spec:
      serviceAccountName: cassandra
      imagePullSecrets:
        - name: instana-registry
      containers:
      - name: cassandra
  managementApiAuth:
    insecure: {}
  size: 3
  allowMultipleNodesPerWorker: false
  resources:
    requests:
      cpu: 2000m
      memory: 8Gi
    limits:
      cpu: 4000m
      memory: 16Gi
  storageConfig:
    cassandraDataVolumeClaimSpec:
      accessModes:
        - ReadWriteOnce
      resources:
        requests:
          storage: 30Gi
  config:
    jvm-server-options:
      initial_heap_size: "4G"
      max_heap_size: "8G"
      additional-jvm-opts:
        - -Dcassandra.allow_unsafe_aggressive_sstable_expiration=true
    cassandra-yaml:
      authenticator: org.apache.cassandra.auth.PasswordAuthenticator
      authorizer: org.apache.cassandra.auth.CassandraAuthorizer
      role_manager: org.apache.cassandra.auth.CassandraRoleManager
      memtable_flush_writers: 8
      auto_snapshot: false
      gc_warn_threshold_in_ms: 10000
      otc_coalescing_strategy: DISABLED
      memtable_allocation_type: offheap_objects
      num_tokens: 256
      drop_compact_storage_enabled: true

      6. Distribuisci Cassandra :

        kubectl apply -f cassandra.yaml -n instana-cassandra

        Per impostazione predefinita, il data center di Cassandra crea un superutente, ad esempio clusterName -superuser. clusterName è il valore specificato nel file .spec.clusterNamecassandra.yaml . Il nome segreto è instana-superuser.

      7. Recupera la password di instana-superuser:

        kubectl get secret instana-superuser -n instana-cassandra --template='{{index .data.password | base64decode}}' && echo

      8. Nel config.yaml file, sostituisci <RETRIEVED_FROM_SECRET> con la password recuperata:

        datastoreConfigs:
  ...
  cassandraConfigs:
    - user: instana-superuser
      password: <RETRIEVED_FROM_SECRET>
      adminUser: instana-superuser
      adminPassword: <RETRIEVED_FROM_SECRET>
  ...

    5. Installare l' ClickHouse:

      1. Se si sta implementando Custom Edition su un cluster Red Hat OpenShift, creare un file, ad esempio clickhouse-scc.yaml:
        apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: clickhouse-scc
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: RunAsAny
fsGroup:
  type: RunAsAny
supplementalGroups:
  type: RunAsAny
allowHostDirVolumePlugin: false
allowHostNetwork: true
allowHostPorts: true
allowPrivilegedContainer: false
allowHostIPC: true
allowHostPID: true
readOnlyRootFilesystem: false
users:
  - system:serviceaccount:instana-clickhouse:clickhouse-operator
  - system:serviceaccount:instana-clickhouse:clickhouse-operator-ibm-clickhouse-operator
  - system:serviceaccount:instana-clickhouse:clickhouse
  - system:serviceaccount:instana-clickhouse:clickhousekeeper

      2. Applicare il file:

        # Applicable for Openshift cluster
kubectl apply -f clickhouse-scc.yaml

      3. Installare l'operatore ClickHouse :

        helm install clickhouse-operator ibm-clickhouse-operator-v1.2.39.tgz -n instana-clickhouse --version=v1.2.0 --set operator.image.repository=<internal-image-registry>/<internal-image-repository-path>/clickhouse-operator --set operator.image.tag=v1.2.39

      4. Creare un file YAML, ad esempio clickhouse_keeper.yaml, con la definizione ClickHouseKeeperInstallation delle risorse.

        apiVersion: "clickhouse-keeper.altinity.com/v1"
kind: "ClickHouseKeeperInstallation"
metadata:
  name: clickhouse-keeper
  namespace: instana-clickhouse
spec:
  configuration:
    clusters:
      - name: "local"
        layout:
          replicasCount: 3
    settings:
        logger/level: "information"
        logger/console: "true"
        listen_host: "0.0.0.0"
        keeper_server/snapshot_storage_path: /var/lib/clickhouse-keeper/coordination/snapshots/store
        keeper_server/log_storage_path: /var/lib/clickhouse-keeper/coordination/logs/store
        keeper_server/storage_path: /var/lib/clickhouse-keeper/
        keeper_server/tcp_port: "2181"
        keeper_server/four_letter_word_white_list: "*"
        keeper_server/coordination_settings/raft_logs_level: "information"
        keeper_server/raft_configuration/server/port: "9444"
        prometheus/endpoint: "/metrics"
        prometheus/port: "7000"
        prometheus/metrics: "true"
        prometheus/events: "true"
        prometheus/asynchronous_metrics: "true"
        prometheus/status_info: "false"
        zookeeper/node/host: "localhost"
        zookeeper/node/port: "9181"
  templates:
    podTemplates:
      - name: clickhouse-keeper
        spec:
          # Add the following Affinity snippet to schedule each pod on a different node.
          # affinity:
          #   podAntiAffinity:
          #     requiredDuringSchedulingIgnoredDuringExecution:
          #       - labelSelector:
          #           matchLabels:
          #             app: clickhouse-keeper
          #         topologyKey: "kubernetes.io/hostname"
          containers:
            - name: clickhouse-keeper
              imagePullPolicy: IfNotPresent
              image: <internal-image-registry>/<internal-image-repository-path>/clickhouse:25.8.13.73-7-lts-ibm
              command:
                - clickhouse-keeper
                - --config-file=/etc/clickhouse-keeper/keeper_config.xml
              resources:
                requests:
                  memory: "1Gi"
          serviceAccountName: clickhousekeeper
          imagePullSecrets:
            - name: instana-registry
          securityContext:
            fsGroup: 0
            runAsGroup: 0
            runAsUser: 1001
          initContainers:
            - name: server-id-injector
              imagePullPolicy: IfNotPresent
              image:  <internal-image-registry>/<internal-image-repository-path>/clickhouse:25.8.13.73-7-lts-ibm
    volumeClaimTemplates:
      - name: log-storage-path
        spec:
          storageClassName: <storage_class_name>
          accessModes:
            - ReadWriteOnce
          resources:
            requests:
              storage: 20Gi
      - name: snapshot-storage-path
        spec:
          storageClassName: <storage_class_name>
          accessModes:
            - ReadWriteOnce
          resources:
            requests:
              storage: 20Gi

      5. Distribuisci ClickHouseKeeper.

        kubectl apply -f clickhouse_keeper.yaml -n instana-clickhouse

      6. Crea un file, ad esempio clickhouse_installation.yaml:

        apiVersion: "clickhouse.altinity.com/v1"
kind: "ClickHouseInstallation"
metadata:
  name: "instana"
spec:
  defaults:
    templates:
      dataVolumeClaimTemplate: instana-clickhouse-data-volume
      logVolumeClaimTemplate: instana-clickhouse-log-volume
      serviceTemplate: service-template
  configuration:
    files:
      config.d/storage.xml: |
        <clickhouse>
          <storage_configuration>
            <disks>
              <default/>
              <cold_disk>
                <path>/var/lib/clickhouse-cold/</path>
              </cold_disk>
            </disks>
            <policies>
              <logs_policy>
                <volumes>
                  <data>
                    <disk>default</disk>
                  </data>
                  <cold>
                    <disk>cold_disk</disk>
                  </cold>
                </volumes>
              </logs_policy>
              <logs_policy_v4>
                <volumes>
                  <tier1>
                    <disk>default</disk>
                  </tier1>
                  <tier2>
                    <disk>cold_disk</disk>
                  </tier2>
                </volumes>
              </logs_policy_v4>
            </policies>
          </storage_configuration>
        </clickhouse>
    clusters:
      - name: local
        templates:
          podTemplate: clickhouse
        layout:
          shardsCount: 1
          replicasCount: 2 # The replication count of 2 is fixed for Instana backend installations
        schemaPolicy:
          replica: None
          shard: None
    zookeeper:
      nodes:
        - host: clickhouse-keeper-headless.instana-clickhouse  #if you use ClickhouseKeeper
      # - host: instana-zookeeper-headless.instana-clickhouse
    profiles:
      default/prefer_localhost_replica: 1
      default/max_memory_usage: 10000000000 # If memory limits are set, this value must be adjusted according to the limits.
      default/joined_subquery_requires_alias: 0
      default/max_execution_time: 100
      default/max_query_size: 1048576
      default/use_uncompressed_cache: 0
      default/enable_http_compression: 1
      default/load_balancing: random
      default/background_pool_size: 32
      default/background_schedule_pool_size: 32
      default/distributed_directory_monitor_split_batch_on_failure: 1
      default/distributed_directory_monitor_batch_inserts: 1
      default/insert_distributed_sync: 1
      default/log_queries: 1
      default/log_query_views: 1
      default/max_threads: 16
      default/allow_experimental_database_replicated: 1
      default/allow_experimental_analyzer: 0
    quotas:
      default/interval/duration: 3600
      default/interval/queries: 0
      default/interval/errors: 0
      default/interval/result_rows: 0
      default/interval/read_rows: 0
      default/interval/execution_time: 0
    settings:
      remote_servers/all-sharded/secret: clickhouse-default-pass
      remote_servers/all-replicated/secret: clickhouse-default-pass
      remote_servers/local/secret: clickhouse-default-pass
      max_concurrent_queries: 200
      max_table_size_to_drop: 0
      max_partition_size_to_drop: 0
    users:
      default/password: "clickhouse-default-pass"
      clickhouse-user/networks/ip: "::/0"
      clickhouse-user/password: "clickhouse-pass"
      # Or
      # Generate password and the corresponding SHA256 hash with:
      # $ PASSWORD=$(base64 < /dev/urandom | head -c8); echo "$PASSWORD"; echo -n "$PASSWORD" | sha256sum | tr -d '-'
      # 6edvj2+d                                                          <- first line is the password
      # a927723f4a42cccc50053e81bab1fcf579d8d8fb54a3ce559d42eb75a9118d65  <- second line is the corresponding SHA256 hash
      # clickhouse-user/password_sha256_hex: "a927723f4a42cccc50053e81bab1fcf579d8d8fb54a3ce559d42eb75a9118d65"
      # Or
      # Generate password and the corresponding SHA1 hash with:
      # $ PASSWORD=$(base64 < /dev/urandom | head -c8); echo "$PASSWORD"; echo -n "$PASSWORD" | sha1sum | tr -d '-' | xxd -r -p | sha1sum | tr -d '-'
      # LJfoOfxl                                  <- first line is the password, put this in the k8s secret
      # 3435258e803cefaab7db2201d04bf50d439f6c7f  <- the corresponding double SHA1 hash, put this below
      # clickhouse-user/password_double_sha1_hex: "3435258e803cefaab7db2201d04bf50d439f6c7f"
  templates:
    podTemplates:
      - name: clickhouse
        spec:
          # Add the following Affinity snippet to schedule each pod on a different node.
          # affinity:
          #   podAntiAffinity:
          #     requiredDuringSchedulingIgnoredDuringExecution:
          #       - labelSelector:
          #           matchExpressions:
          #             - key: "clickhouse.altinity.com/app"
          #               operator: In
          #               values:
          #                 - "chop"
          #         topologyKey: "kubernetes.io/hostname"
          containers:
            - name: instana-clickhouse
              image: <internal-image-registry>/<internal-image-repository-path>/clickhouse:25.8.13.73-7-lts-ibm
              command:
                - clickhouse-server
                - --config-file=/etc/clickhouse-server/config.xml
              volumeMounts:
                - mountPath: /var/lib/clickhouse-cold/
                  name: instana-clickhouse-data-cold-volume
            - name: clickhouse-log
              image: <internal-image-registry>/<internal-image-repository-path>/clickhouse:25.8.13.73-7-lts-ibm
              args:
                - while true; do sleep 30; done;
              command:
                - /bin/sh
                - -c
                - --
          serviceAccountName: clickhouse
          imagePullSecrets:
            - name: instana-registry
          securityContext:
            fsGroup: 0
            runAsGroup: 0
            runAsUser: 1001
        # Optional - uncomment the following lines if resources need to be specifically defined for the clickhouse pods. The  following values are for example only.
        # resources:
        #   limits:
        #     cpu: "4"
        #     memory: 4Gi
        #   requests:
        #     cpu: "1"
        #     memory: 2Gi
  volumeClaimTemplates:
    - name: instana-clickhouse-data-volume
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 100Gi
    - name: instana-clickhouse-log-volume
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 1Gi
    - name: instana-clickhouse-data-cold-volume
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 100Gi
  serviceTemplates:
    - name: service-template
      generateName: "clickhouse-{chi}"
      spec:
        ports:
          - name: http
            port: 8123
          - name: tcp
            port: 9000
        type: ClusterIP

      7. Aggiorna il zookeeper.nodes.host campo con il nome host del tuo cluster Clickhouse Keeper.

        Per impostazione predefinita, clickhouse-user e clickhouse-pass vengono aggiunti a ClickHouse.

      8. Distribuisci ClickHouse.

        kubectl apply -f clickhouse_installation.yaml -n instana-clickhouse

      9. Nel config.yaml file, sostituisci <USER_GENERATED_PASSWORD> con la password recuperata:

        Nota:
        È necessario utilizzare la stessa password casuale creata in precedenza al momento dell'installazione di ClickHouse (versione online) o di ClickHouse (versione offline). Non utilizzare la password hash corrispondente SHA256.
        datastoreConfigs:
  ...
  clickhouseConfigs:
    - user: clickhouse-user
      password: <USER_GENERATED_PASSWORD>
      adminUser: clickhouse-user
      adminPassword: <USER_GENERATED_PASSWORD>
   ...

    6. Opzionale: installare BeeInstana, vedere Installazione dell' BeeInstana Operatore Kubernetes offline (air-gapped).

  10. Installare un operatore aziendal Instana. Creare e configurare un file dei valori da utilizzare nel Instana-Operator file:

    1. Crea un file dei valori, vedi Creazione del file dei valori.

    2. Aggiungi le seguenti righe al file dei valori:

      operator:
  image:
    registry: <internal-image-registry>
    repository: <internal-image-repository-path>/instana-enterprise-operator
webhook:
  image:
    registry: <internal-image-registry>
    repository: <internal-image-repository-path>/instana-enterprise-operator-webhook
imagePullSecrets:
  - name: instana-registry

    3. Applica le modifiche:

      kubectl instana operator apply -n instana-operator  --values <pathtoFile>/values.yaml

    4. Verifica l'implementazione dell'operatore Enterprise dell' Instana :

      kubectl get all -n instana-operator

  11. Dettagli sull'implementazione del core " Instana ".

    1. Crea segreti fondamentali CoreSecret.

    2. Crea un file, ad esempio core.yaml per distribuire il core CreatingACore.

      apiVersion: instana.io/v1beta2
kind: Core
metadata:
  name: instana-core
spec:
  ...
  gatewayConfig:
    controller:
      imageConfig:
        registry: <internal-image-registry>
    gateway:
      imageConfig:
        registry: <internal-image-registry>
  imageConfig:
    registry: <internal-image-registry>
    repository: <internal-image-repository-path>
  imagePullSecrets:
    - name: instana-registry
  ...

  12. Distribuisci un'unità Instana.

    1. Recupera la chiave di DownloadingTheLicenseFile licenza.

      kubectl instana license download --sales-key <redacted>

    2. Crea segreti dell'unità UnitSecret.

    3. Crea un file, ad esempio units.yaml per distribuire l'unità CreateAUnitAndTenant.